Malicious PDF — malware analysis report

Static analysis result for SHA-256 059ba4cdab260c8f…

MALICIOUS

PDF

85.0 KB Created: 2021-04-20 06:00:22 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 61d0f0e67a45c55a10c9e60a3a74592d SHA-1: 58df95c4036e7cf8df763ef9e8a32a28fb2ab52e SHA-256: 059ba4cdab260c8fc446afbdcde5006e24b1cda637d5d22344caeae456b82ebe
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains heuristics indicating it is malicious and a phishing attempt, specifically mentioning a download lure. The embedded URL `https://jumiwimov.ru/strik?utm_term=autocad+download+for+pc+latest+version` strongly suggests the document is designed to trick users into downloading malware by posing as a legitimate software installer. The ML classifier and ClamAV detection further support the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 5

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jumiwimov.ru/strik?utm_term=autocad+download+for+pc+latest+version
    • https://cdn.sqhk.co/ketalidukepi/ajhEYjf/emergency_dentist_brooklyn_services_pc.pdf
    • http://lnstagramsupportingcenter.com/56920944047361vx.pdf
    • http://1fps.ru/15750578103wdjgt.pdf
    • https://cdn.sqhk.co/puxezuxivas/ijA2Xhe/37732487414.pdf
    • http://vapokox.22web.org/what_does_i_paint_houses_mean_in_the_irishman.pdf
    • https://cdn.sqhk.co/lisutovudaf/hoXtjbw/burger_king_nyc_locations.pdf
    • http://urologo.store/24554326663hjshc.pdf
    • http://zuvilivupeke.iblogger.org/why_wont_my_hp_deskjet_2540_connect_to_wifi.pdf
    • https://cdn.sqhk.co/rudixika/v5ig6gj/petroleum_engineering_salary_in_us_per_month.pdf
    • http://nuduxebevevewu.22web.org/free_download_contoh_surat_lamaran_kerja.doc.pdf
    • https://cdn.sqhk.co/gitaligido/jbgfIju/ikea_design_your_own_living_room_online.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://uploads.strikinglycdn.com/files/b89b428c-7a0d-456f-b2f6-829865dfba54/89741754741.pdf
    • http://dogirajuwuxo.epizy.com/succession_planning_policy.pdf
    • https://uploads.strikinglycdn.com/files/50bfc36f-f485-498c-8d16-a314b3953610/koximefa.pdf
    • http://rijowetunif.rf.gd/jamila_aitmatov.pdf
    • https://uploads.strikinglycdn.com/files/4514b442-8e65-40a3-a1a8-32ae57d90a5b/man_in_the_high_castle_season_3_episode_5_cast.pdf
    • https://uploads.strikinglycdn.com/files/27fb6db0-409a-44e9-bb4f-b5b9689d2269/tujuvedu.pdf
    • http://legumanob.rf.gd/geographic_information_system_program_in_canada.pdf
    • http://zobowubi.epizy.com/carl_sagan_cosmos_ep_2.pdf
    • http://fodimezafizuver.epizy.com/lady_windermeres_fan_movie.pdf
    • http://dipobitabi.rf.gd/worej.pdf
    • https://uploads.strikinglycdn.com/files/141cdf83-bfd6-4da2-9c0f-f36bbac10421/12782847311.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010dae.bin
79bf3eed76c38efbc8479e3ffc4368194907c77a606269407559ecd36ac85189		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DAE 5292 bytes
font_01_sfnt_off00011fd8.bin
e120d3eab9d7105bd43c475f6ae832fda0acc560007f313d81d71d09ba9763d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11FD8 11320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.